#1059618 ITP: ssh3 -- faster and rich secure shell using HTTP/3

#1059618#5
Date:
2023-12-29 10:30:14 UTC
From:
To:
* Package name    : ssh3
  Version         : 0.1.4
  Upstream Contact: François Michel
* URL             : https://github.com/francoismichel/ssh3
* License         : Apache-2.0
  Programming Lang: Go
  Description     : faster and rich secure shell using HTTP/3

SSH3 is a complete revisit of the SSH protocol, mapping its semantics on
top of the HTTP mechanisms. In a nutshell, SSH3 uses QUIC+TLS1.3 for
secure channel establishment and the HTTP Authorization mechanisms for
user authentication. Among others, SSH3 allows the following
improvements:

- Significantly faster session establishment

- New HTTP authentication methods such as OAuth 2.0 and OpenID Connect
  in addition to classical SSH authentication

- Robustness to port scanning attacks: your SSH3 server can be made
  invisible to other Internet users

- UDP port forwarding in addition to classical TCP port forwarding

- All the features allowed by the modern QUIC protocol: including
  connection migration (soon) and multipath connections

I hope this package can be maintained in the Debian Go Packaging Team.

#1059618#16
Date:
2023-12-30 12:37:55 UTC
From:
To:
Packaging of SSH3 is available here:

https://salsa.debian.org/go-team/packages/ssh3
https://salsa.debian.org/jas/ssh3/

Thanks to the Salsa CI/CD pipeline there is an aptly repository
available for easy testing, if anyone would like to experiment or help.

Below you can find a snippet how you can test the SSH3 client and server
via Debian packages, for password and public key authentication, in a
safe container using podman.  I have only tested this on my laptop that
runs Trisquel, but should hopefully be portable.

I am delaying upload to Debian for a while to see if upstream reaches a
conclusion around naming.  I think the name 'ssh3' is unfortunate and
distracts from the effort. See:
<https://github.com/francoismichel/ssh3/issues/79>.

/Simon

sudo apt install podman
podman run -it --hostname myhost.example --rm debian:unstable
cd
apt update
apt dist-upgrade -y
apt install -y ca-certificates
echo "deb [trusted=yes] https://salsa.debian.org/jas/ssh3/-/jobs/5094673/artifacts/raw/aptly unstable main" | tee /etc/apt/sources.list.d/ssh3.list
apt update
apt install -y ssh3

apt install -y ssl-cert # creates snakeoil key/cert

passwd # set a test password for 'root' e.g. 'foo'

ssh3-server -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key -enable-password-login -url-path /myurl -v &

ssh3 -v -insecure -use-password myhost.example/myurl
# type 'foo' at the prompt, and on successful connection type 'exit' to log out

apt install -y openssh-client # for ssh-keygen
ssh-keygen -t ed25519 -P "" -f /root/.ssh/id_ed25519
cat /root/.ssh/id_ed25519.pub > /root/.ssh3/authorized_identities
ssh3 -v -insecure -privkey /root/.ssh/id_ed25519 myhost.example/myurl
# on successful connection type 'exit' to log out

#1059618#21
Date:
2023-12-30 12:47:48 UTC
From:
To:
I agree - as the Debian OpenSSH maintainer, I'm concerned that this will
cause a new source of user confusion because people will think "ah,
ssh3, that must be better than ssh" (which indeed seems to have been a
deliberate marketing choice by this project) and not realize that it's a
largely incompatible thing.  Not to mention the way that it parses
OpenSSH configuration files, which may work today but I doubt OpenSSH
offers any guarantees that it won't make changes that will break this
independent parser in future.

I also feel that something security-critical like this that's labelled
by upstream as "still experimental" probably shouldn't be in a Debian
release.  Maybe it should be kept in Debian experimental for the time
being?

#1059618#26
Date:
2023-12-30 16:54:03 UTC
From:
To:
Colin Watson <cjwatson@debian.org> writes:

I share these concerns, so I'll delay the upload for now.  I'm hoping
upstream will rename the project to something less confusing.

Sounds good if nothing happens on the naming front in the next
weeks/months.  Let's wait and see a bit.

One alternative that was suggested was to call the package something
else in Debian.  'golang-ssh3'?  'go-ssh3'?  Still somewhat problematic
as long as the 'ssh3' name is in there.

/Simon

#1059618#31
Date:
2023-12-31 15:26:40 UTC
From:
To:
It is written in Go. The problem of Go library support in Debian should
also be considered for a security-critical tool like this.

https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#golang-static-linking

Regards

#1059618#36
Date:
2025-02-06 12:20:39 UTC
From:
To:
Hi Simon,

Could you please consider packaging "ssh3" as "soh"?

Upstream has already agreed to the rename, it just hasn't been done
yet. You wouldn't even need to write the patch yourself, as a pull
request performing the rename has been opened already at
<https://github.com/francoismichel/ssh3/pull/96>.

I think having soh in Debian would be great.

Bye!

#1059618#41
Date:
2025-02-06 12:32:44 UTC
From:
To:
Hi

I also think it would be nice to upload, but upstream didn’t really make a decision as far as I can tell.

https://github.com/francoismichel/ssh3/issues/79

Maybe you could explain to upstream that this would get packaged if they did the renaming and a new release?

Shipping it as “soh” if that isn’t where upstream is going seems potentially worse than just waiting a bit more to let upstream make some decision. If they already abandoned the project, maybe it doesn’t make sense to package it at all.

/Simon

#1059618#46
Date:
2025-02-06 12:39:35 UTC
From:
To:
Il giorno gio 6 feb 2025 alle 13:32:44 +01:00:00, Simon Josefsson
<simon@josefsson.org> ha scritto:

Reading
<https://github.com/francoismichel/ssh3/issues/79#issuecomment-1879004877>,
I had the impression that the decision was made. But yeah, now that I
re-read it I see that the upstream developer doesn't seem that
convinced about the rename. He still recommended that name for
packagers, though.

Makese sense. Doing it now.

True. I thought the decision was made, though.

This is true as well :)

I'll try to leave a comment on the GitHub issue and see what happens.
Bye!